Internal audits are how your management system checks itself. Clause 9.2 of ISO 9001, ISO 14001, ISO 45001 and ISO 27001 all require them, and the certification auditor will look at your audit records early on to judge how much they can rely on your system. Done well, internal audits find problems before customers or regulators do.
Build an audit programme
Plan which processes and clauses you will audit, and when, across a cycle, usually one year. Audit more often where risk is higher, where there have been problems, or where things have changed. Every part of the scope must be covered within the cycle.
Choose impartial auditors
Auditors must be objective and impartial, which in practice means not auditing their own work. In a small business, swap areas between managers, train two or three people as internal auditors, or use an outside auditor for the areas nobody else can cover. ISO 19011 is the guidance standard for auditing and is worth reading.
Planning a single audit
- Confirm the scope (which process, site or clause) and the criteria (the standard, your procedures, legal requirements).
- Look at the last audit results, open actions, incidents and complaints in that area.
- Prepare a short checklist of questions and the records you want to sample, but be ready to follow the trail.
- Agree a time with the people you will interview.
Gathering evidence
Audit the process, not the paperwork. Ask people to show you how they do the job, then check the records that prove it. Sample real records: pick three recent orders, two training records, last month's inspections. Follow one thing from start to finish, for example an order from enquiry to invoice.
Write down what you saw: record numbers, dates and names. "Checked training records" is not evidence; "Checked forklift training for J. Smith, certificate dated 3 March 2026, valid" is.
Writing findings
- Major nonconformity: a requirement is not met at all, or there is a breakdown that puts the system or product at risk.
- Minor nonconformity: a single lapse that does not undermine the system.
- Observation or opportunity for improvement: no requirement is broken, but something could be better.
- For each nonconformity, state the requirement, what you found, and the evidence. Keep it factual and avoid blame.
After the audit
Hold a short closing meeting, share the report, and make sure every nonconformity goes into corrective action with an owner, root cause and due date. Check later that the fix worked. Report audit results to the management review.
Frequently asked questions
How often should internal audits be done?
Often enough to cover the whole scope within your audit cycle, usually a year, with higher-risk or problem areas audited more often.
Can a one-person business audit itself?
Impartiality is hard when you do everything. Many sole traders and micro businesses use a contracted auditor or swap audits with another small business.
Do internal auditors need a qualification?
The standards require auditors to be competent, not certificated. A short internal auditor course and some supervised audits are the usual route, with the training recorded.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.